topic Re: ASA logs in Network Security

ASA logs

suthomas1 — Mon, 11 Mar 2019 15:09:51 GMT

Hi..

I am facing issue with accessing firewall syslog files.the size is around 2GB.It says i need to open it with another editor rather than notepad.I tried with wordpad but it hungsup.

Any suggestions on this.Also i have heard that the logs are stored by date( a day each) in seperate log files.How do i enable that?

Thanks in advance!

Re: ASA logs

cisco24x7 — Wed, 25 Mar 2009 12:20:58 GMT

The best syslog would be syslog-ng which will give the ability to rotate the log file at certain size, date, etc... If you have multiple firewalls, syslog-ng can store logs in separate files.

syslog-ng comes free with most Linux distribution

Re: ASA logs

Collin Clark — Wed, 25 Mar 2009 13:02:24 GMT

Any application will have trouble opening a 2GB log file. Try using a syslog server like RSyslog (http://www.rsyslog.com/) it also has a web front-end so you can view a log and filter the results. If you want to have each device as a separate log file, you will need to configure it in your conf file on your server.

Hope that helps.

Re: ASA logs

suthomas1 — Wed, 25 Mar 2009 13:49:26 GMT

ok..not each device as seperate log file...same device but it would give seperate log files for each day..is there a way on this..

thanks!

Re: ASA logs

Collin Clark — Wed, 25 Mar 2009 13:53:49 GMT

Sure, again it would be configured in the syslog conf file.

Re: ASA logs

cisco24x7 — Wed, 25 Mar 2009 14:11:29 GMT

This is why "splunk" was developed.

Re: ASA logs

lorih.fns — Wed, 25 Mar 2009 20:25:26 GMT

For viewing large syslog files, or any large text file for that matter, I like UltraEdit. UltraEdit can handle and edit files in excess of 4 gigabytes.

It's fairly inexpensive and has tons of great attributes that make it worth every penny!!!

Re: ASA logs

Collin Clark — Wed, 25 Mar 2009 20:31:30 GMT

UltraEdit is the best text editor out there, however even it has problems with a 2GB file (probably more the PC than the app). I also use GSplit to take the file and break it up. Excel and it's Auto Filter option are very useful as well.

Re: ASA logs

cisco24x7 — Thu, 26 Mar 2009 00:06:48 GMT

Why would anyone want to view a >2GB file is beyond me. Perl, MySQL, awk and grep were developed for extracting from large file like this.

Re: ASA logs

suthomas1 — Fri, 27 Mar 2009 02:39:00 GMT

thanks for the inputs..another query.

how do you stop the logs being continually generated/updated to the particular text file inside the system logs from the device.

I am trying to delete the log file...but it says something else is using this,probably the firewall is generating logs into this.

Any ideas on this..how do we stop this for sometime..do i need to configure anything on firewall for this?

Thanks!!

Re: ASA logs

suthomas1 — Sun, 29 Mar 2009 13:23:00 GMT

Any ideas on stopping the above!

thanks!!

Re: ASA logs

Collin Clark — Mon, 30 Mar 2009 13:19:53 GMT

You either have to stop syslog from the firewall, stop it on the server or copy the log file and read the copied file.